Fix crash if utterance is garbage-collected before speech ends.

Source/modules/speech/SpeechSynthesis.cpp

 /*
  * Copyright (C) 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 135 matching lines @@
 void SpeechSynthesis::fireEvent(const AtomicString& type, SpeechSynthesisUtterance* utterance, unsigned long charIndex, const String& name)
 {
     if (!executionContext()->activeDOMObjectsAreStopped())
         utterance->dispatchEvent(SpeechSynthesisEvent::create(type, charIndex, (currentTime() - utterance->startTime()), name));
 }
 
 void SpeechSynthesis::handleSpeakingCompleted(SpeechSynthesisUtterance* utterance, bool errorOccurred)
 {
     ASSERT(utterance);
 
+    // Keep the utterance around long enough to fire an event on it in case m_utteranceQueue
+    // is holding the last reference to it.
+    RefPtrWillBeRawPtr<SpeechSynthesisUtterance> protect(utterance);
+
     bool didJustFinishCurrentUtterance = false;
     // If the utterance that completed was the one we're currently speaking,
     // remove it from the queue and start speaking the next one.
     if (utterance == currentSpeechUtterance()) {
         m_utteranceQueue.removeFirst();
         didJustFinishCurrentUtterance = true;
     }
 
     // Always fire the event, because the platform may have asynchronously
     // sent an event on an utterance before it got the message that we
@@ skipping 67 matching lines @@
     return EventTargetNames::SpeechSynthesisUtterance;
 }
 
 void SpeechSynthesis::trace(Visitor* visitor)
 {
     visitor->trace(m_voiceList);
     visitor->trace(m_utteranceQueue);
 }
 
 } // namespace WebCore